Researchers Develop Novel Framework to Detect Obfuscated Malware

Strategic Insights -

Research findings from the University of Rosario have discussed the threats posed by malicious software (malware) and the challenges of detecting advanced malware that employs obfuscation techniques. A novel framework, DEFENDIFY, has been developed to overcome these challenges. The framework employs Computer Vision, Deep Learning, and Transfer Learning techniques to detect both obfuscated and non-obfuscated malware with high performance in terms of accuracy and computational consumption. Researchers conducted experiments using real data gathered from malware repositories and legitimate software, and the proposed framework achieved promising results, with an F1-score of 99.34% and 97.5% for detecting non-obfuscated and obfuscated samples, respectively.

Key Takeaways:

  • The existence of malicious software (malware) poses a significant threat to users who connect to a large set of services provided by multiple providers.
  • Malware can steal, spy on, encrypt data from users, and spread, causing impacts that are beyond a single citizen's device and reaching critical information systems.
  • Machine Learning and Deep Learning techniques have been employed recently to detect malware families, but they lack in detecting more advanced malware that employs obfuscation techniques.
  • DEFENDIFY, a novel framework, has been developed that employs Computer Vision, Deep Learning, and Transfer Learning techniques to detect completely obfuscated malware with high performance in terms of accuracy and computational consumption.
  • The framework comprises three modules: Dataset Creation, Binary Obfuscation, and Model Generation, which work together to detect both obfuscated and non-obfuscated malware.
  • The core module, Model Generation, employs an entropy tester that determines whether a sample is obfuscated or not.
  • A Deep Learning model powered by Transfer Learning is employed to determine if it is malware or goodware.
  • The proposed framework was configured to test four Convolutional Neural Network architectures, with ResNet18 architecture obtaining the best performance in detecting both non-obfuscated and obfuscated samples.
  • The F1-score for detecting non-obfuscated samples was 99.34%, and for obfuscated samples was 97.5%.
  • The research was conducted by a team of researchers from the University of Rosario, led by Rodrigo Castillo Camargo.
  • The publication is available in the journal Cybersecurity, Volume 8, Issue 1, 2025, and can be accessed at https://cybersecurity.springeropen.com/.

Statistics:

  • The F1-score for detecting non-obfuscated samples was 99.34%.
  • The F1-score for detecting obfuscated samples was 97.5%.
  • The proposed framework was configured to test four Convolutional Neural Network architectures: ResNet18, ResNet34, EfficientNetB3, and EfficientNetV2S.
  • The ResNet18 architecture obtained the best performance in detecting both non-obfuscated and obfuscated samples.

Sources:

  • DEFENDIFY: defense amplified with transfer learning for obfuscated malware framework. Cybersecurity, 2025,8(1):1-23.
  • Universidad Del Rosario
  • Ministerio De Comercio, Industria Y Turismo
  • Ministerio De Universidades
  • Nvidia